I made a cool 5 word passphrase back then using the old Diceware
method and use it as a master password. The question is as computing
power increases will we need to add more and more words to our
passphrases which we will eventually forget? I'm in my mid 30s, will
passphrases be enough in my lifetime? :) So back then, Diceware
suggested just 5 words, not the original Bitcoin QT client recommends
8 words. Will theoriginal 5 words from the Diceware age will serve me
in the Bitcoin age?
Bitcoin (well, the wallet software, anyway) is being a bit conservative. A 5-word passphrase might be a bit on the low side, but if your words have been chosen randomly from some dictionary with about 7.5k words, as claimed on the Diceware page, you should be safe, as this comes out at roughly $64$ bits of entropy. This should remain a strong passphrase for the next decade or two at least, but there's no real way to know. You'll probably be fine anyway if you're not a high-value target. Most attacks today are done against a large batch of weak (and weakly protected) passwords, not a single strong one.
How effective is doubling a passphrase? Like I have now [passphrase]
and simply doule it: [passphrase][passphrase]. So I don't really have
more stuff to remember, just more stuff to type. That might serve me
for a time.
It doesn't really help all that much. You're not adding lots of uncertainty to the new passphrase, you just doubled it. Now that this question is on the public internet, an attacker trying to target you might try every combination of 5 words, and then double them and try again, just in case you doubled your passphrase. This means the attacker will have to work twice as hard to obtain your passphrase, not very useful. Adding a single Diceware-grade word is considerably more effective.
Oh, another interesting question as well: let's say I use one exact
password on many similar forum pages. Will this generate the exact
same hashes if they use the same forum engine? I know, you can't
recover the password from the hash, but they may find same hash = same
guy, right?
It depends. In an ideal world.. no. The hash functions would be different, and they would use a random salt anyway. But, in the real world, yes, it's quite likely that many forums out there are still using MD5(password) and in that case, the same hash will end up in multiple databases, which is bad.
But if a forum engine is well-designed, that should not happen - each user will be given a random "salt" to differentiate his password from other users', this means if you create the same account on two different forums (even using the same forum code) you will most likely be given different salts, which'll make the two hashes differ.
I don't really want to mess around with a Yubikey. Heck, I Googled it
and didn't really managed to find out what it is, what it does. Maybe
I'm not the target market. I'm just a simple user. Carrying around a
Yubikey would also be a red flag in my eyes. He has secrets!
Everyone has secrets, and people carry around authenticators already, don't they? :) Basically, it's a two-factor authentication token. When you log into a website, you usually only use one-factor authentication: you know your password. But in a two-factor authentication process, you need to provide what you know (password, passphrase) and something else, either of:
- what you are (biometric fingerprint, retina scan)
- what you have (a physical object, such as a security token)
